S/MIME signature verification filter for OpenSMTPD
filter-smime is an smtpd(8) filter, on libopensmtpd, that verifies the
S/MIME signature of each incoming message and writes the result at the
top of the message as an Authentication-Results header (RFC 8601,
method smime of RFC 7281):

    Authentication-Results: <authserv-id>; smime=<result>
        [reason="<reason>"] [header.from=<addr>]
        [body.smime-identifier=<signer>]

Its argument is a PEM bundle of trusted CA certificates; -s sets the cap
of one message, 16 MiB by default, past which it is not verified
(neutral, toolarge). The message is buffered once: a clear-signed one is
verified in place, an opaque application/pkcs7-mime one decoded from the
buffer. An allocation of the filter that fails, or one libcrypto reports
failing, drops the message: nothing of it is written back but its final
dot, and it is refused at commit with a temporary failure, 451 4.3.0, so
it is never queued altered; the filter goes on. libopensmtpd still exits
on failures of its own, and may drop a write of another answer: see the
manual, CAVEATS. The authserv-id is the admd smtpd(8) sends its filters.
The result is pass, fail (the signature does not match the content),
policy (the signer does not chain to the bundle, or the From address is
not in its certificate), none, neutral or permerror.

The filter refuses no message for its result and removes no header:
every received line is written back, the message queued unchanged short
of a dropped write, the decision is left to what reads the header, and
forged headers to filter-admdscrub, run before it. One log line per
message goes to stderr:
smime from=<addr> result=<result> reason=<reason>. No CRL or OCSP check
is made.

Maintainer: Jean-Gerard Pailloncy <j-g@pailloncy.com>
